SANTA CLARA VALLEY MEDICAL CENTER

Report ID: B0DT11.01, California Department of Public Health

Reported Entity: SANTA CLARA VALLEY MEDICAL CENTER

Issue:

Based on interview and record review, the hospital failed to prevent the unauthorized disclosure of Patient Health Information (PHI) for 29 of 29 sampled patients (1-29), when a physician's car was broken into and a messenger bag containing PHI was stolen. The failure resulted in the disclosure of 29 patients' PHI to an unauthorized individual(s). Findings:The California Department of Public Health received a faxed report on 6/18/14, which indicated physician A (MD A) left two surgery schedule documents located in a messenger bag, unattended in her car. The messenger bag was stolen when MD A's car had been vandalized. The documents which were stolen disclosed the names, ages, dates of birth, medical record numbers, and clinical information for 29 hospital patients. During an interview on 10/7/14 at 2 p.m., the ethics and compliance officer (ECO) stated MD A had a surgery list of pending procedures from 6/9/14 to 6/20/14. As per ECO, MD A kept a copy of the schedule with her in case she needed access to it when not at the hospital. ECO stated MD A's car was broken into and a bag containing the surgery schedule documents was stolen. ECO stated MD A's car was parked in a busy parking lot, and other cars parked in the vicinity were also broken into. ECO stated a police report had been filled out.During an interview on 10/9/14 at 9 a.m., MD A stated she had just come off duty and parked her car in a parking lot and was gone about one hour. When she arrived back at her locked car, she noticed the passenger side window had been smashed and her bag containing the surgery schedule was gone. MD A stated there were others cars nearby which also had windows smashed, the police were already there and she filled out a police report. MD A stated the surgery schedule documents were printed by the hospital and did not have column headings nor the hospital's name.A review of a copy of the surgery schedule documents which had been stolen, indicated dates of surgery, names of patients, medical record numbers, and types of surgeries to be performed were disclosed.A review of a copy of the police report dated 6/12/14 indicated MD A's car was broken into between 6:45 p.m. and 8:30 p.m. in a parking lot. The front passenger window had been smashed and a bag, which had contained various medical supplies and a prescription pad, had been stolen from the front passenger seat. A review of a copy of a letter sent on 6/17/14 from the hospital to the affected patients indicated MD A's car had been vandalized and property stolen, which included documents with the affected patients' names, ages, dates of birth, medical record numbers, and clinical information disclosed.A review of a copy of the hospital's 10/15/09 "Safeguarding Protected Health Information" policy indicated documents containing PHI must be adequately safeguarded against unauthorized disclosure. Lock all documents being stored, whether short term or long term storage.

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

3 other violations reported on the same date. Note that other citations may be about the same event: FQY411.01, X6O111.01, X6O111.02